Re: [w3c/webpayments-crypto] Consider Cleartext JWS (#5)

I suggest that browsers MAY verify signatures, but are not required to... the job of verifying the signatures is for the endpoints. We should be decoupling what the browser does (message passing) from the smarts of the edges of the network. 

If you make browsers the gatekeeper of the crypto used, then they become the gatekeepers of how security is done in payments. The browsers should be "dumb pipes", where the smarts are pushed out to the edges (where the expertise in payments and security resides).

IF the group is considering the RFC above, then I also suggest it looks into Linked Data Signatures for at least the following reasons:

1. The signatures are JWS compatible.
1. It's shipping in production. E.g. Mastodon has shipped LD Signatures to over a million users.
1. LD Signatures are the basis for the VCWG work.
1. All of the W3C Credentials Community Group work is based on Linked Data Signatures.
1. Between 10%-19% of all domains on the Web now publish LD as JSON-LD. 
1. You can express the signatures w/o re-signing in multiple syntaxes.
1. They deal with ensuring the semantics of the messages are correct.
1. They're fast - under 1ms to normalize web payments-like messages, signing takes the same amount of time as JWS.

Arguments against are:

There is still active development on the specs as we get implementation feedback from implementers. 

The only reason I'm bringing this up is because this particular issue is considering a more experimental path forward.

More here:

https://w3c-dvcg.github.io/ld-signatures/

and here:

https://w3c-dvcg.github.io/

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webpayments-crypto/issues/5#issuecomment-365939207